Overview

overview

10

Static

static

1

Comprobant...ar.exe

windows7-x64

10

Comprobant...ar.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Comprobante_Popular.exe

  • Size

    4.5MB

  • Sample

    230209-ytdzksbb66

  • MD5

    e2e9fec586f58fe3c395c3c0db09fba9

  • SHA1

    a06bc8ed34fd344332bd36e65bcbb27e67d37052

  • SHA256

    1eae4130dd53ff1b2040e873a91240e882f5b8876504190d5120a7c7cbbb4d69

  • SHA512

    12757e07fe1ebdfba9658d4770da0a38e82547f41401255654673fa8c46eeae7d6db003de59f02ade64bd5e18ff668f5b09c7180a31190a1077a7509830570fe

  • SSDEEP

    49152:m/i9YtvM6deC6gnFds40GdV0sZLigNwKRIq3mjp41ckR62aAo98xAcTnUkcNVuVN:m/iwZ6gn1A

Score
10/10
bandookrattrojanupx

Malware Config

Extracted

Family

bandook

C2

bomes.ru

Targets

    • Target

      Comprobante_Popular.exe

    • Size

      4.5MB

    • MD5

      e2e9fec586f58fe3c395c3c0db09fba9

    • SHA1

      a06bc8ed34fd344332bd36e65bcbb27e67d37052

    • SHA256

      1eae4130dd53ff1b2040e873a91240e882f5b8876504190d5120a7c7cbbb4d69

    • SHA512

      12757e07fe1ebdfba9658d4770da0a38e82547f41401255654673fa8c46eeae7d6db003de59f02ade64bd5e18ff668f5b09c7180a31190a1077a7509830570fe

    • SSDEEP

      49152:m/i9YtvM6deC6gnFds40GdV0sZLigNwKRIq3mjp41ckR62aAo98xAcTnUkcNVuVN:m/iwZ6gn1A

    Score
    10/10
    bandookrattrojanupx

    • Bandook RAT

      Bandook is a remote access tool written in C++ and shipped with a loader written in Delphi.

      rattrojanbandook

    • Bandook payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks